CVE-2026-26998: Traefik Denial of Service Vulnerability Due to Unbounded Response Body Handling
Summary
CVE-2026-26998: Traefik has unbounded io.ReadAll on auth server response body that causes OOM DOS. Affects github.com/traefik/traefik/v2 versions < 2.11.38. Fixed in 2.11.38. How to fix ↓
Also tracked for
The same CVE-2026-26998 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Traefik is an open-source reverse proxy and load balancer designed to simplify the deployment of microservices. It provides features such as automatic service discovery, dynamic configuration, and support for various backends. The ForwardAuth middleware in Traefik is used for authenticating requests by forwarding them to an external authentication server. However, it has a critical vulnerability that allows unbounded reading of response bodies, leading to potential denial of service (DoS) conditions.
Vulnerability Detail
The vulnerability arises from the ForwardAuth middleware's handling of responses from the authentication server. When configured, Traefik reads the entire response body into memory without any size restrictions. This can lead to an out-of-memory (OOM) condition if the authentication server returns a large or infinite response. The lack of a maxResponseBodySize configuration option means that Traefik can allocate unlimited memory, potentially crashing the process and causing a denial of service for all routes served by the affected instance.
How To Fix
Latest published version: v2.11.60 as of 22 Oct 2026
go get github.com/traefik/traefik/v2@v2.11.60Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.11.38
This is the first release that contains the fix.
go get github.com/traefik/traefik/v2@v2.11.38Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no workarounds available to mitigate this vulnerability. It is strongly recommended to update to the patched versions as soon as possible.
Conclusion
The CVE-2026-26998 vulnerability in Traefik poses a significant risk of denial of service due to unbounded reading of response bodies from authentication servers. Users are advised to update to the latest patched versions to ensure the security and stability of their applications.
See every vulnerability recorded for github.com/traefik/traefik/v2 →
FAQ
This vulnerability can lead to a denial of service, where a single request can crash the Traefik process, affecting all services behind the entrypoint.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground without any signup.
Traefik versions prior to v2.11.38 and v3.6.9 are affected by this vulnerability.
No, there is currently no configuration option available to limit the response body size for the ForwardAuth middleware.
While there are no workarounds available, it is crucial to plan for an update to the patched versions to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/traefik/traefik/v2.
